SOCA Access Control System 180612 Information Disclosure

2019-05-13T00:00:00
ID ZSL-2019-5517
Type zeroscience
Reporter Gjoko Krstic
Modified 2019-05-13T00:00:00

Description

Title: SOCA Access Control System 180612 Information Disclosure
Advisory ID: ZSL-2019-5517
Type: Local/Remote
Impact: Disclosure of Sensitive Information
Risk: (4/5)
Release Date: 13.05.2019

Summary

The company's products include proximity and fingerprint access control system, time and attendance, electric locks, card reader and writer, keyless entry system and other 30 specialized products. All products are attractively designed with advanced technology in accordance with users' safety and convenience which also fitted international standard.

Description

Insecure direct object references occur when an application provides direct access to objects based on user-supplied input. As a result of this vulnerability attackers can bypass authorization and access resources and functionalities in the system.

Vendor

SOCA Technology Co., Ltd - <http://www.socatech.com>

Affected Version

180612
170000
141007

Tested On

Windows NT 6.1 build 7601 (Windows 7 Service Pack 1) i586
Windows NT 6.2 build 9200 (Windows Server 2012 Standard Edition) i586
Apache/2.2.22 (Win32)
PHP/5.4.13

Vendor Status

N/A

PoC

soca_info.txt

Credits

Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>

References

[1] <https://www.exploit-db.com/exploits/46832>
[2] <https://packetstormsecurity.com/files/152836>
[3] <https://cxsecurity.com/issue/WLB-2019050152>
[4] <https://exchange.xforce.ibmcloud.com/vulnerabilities/160978>

Changelog

[13.05.2019] - Initial release
[15.05.2019] - Added reference [4]

Contact

Zero Science Lab

Web: <http://www.zeroscience.mk>
e-mail: lab@zeroscience.mk

                                        
                                            REQUEST LIMIT REACHED